Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-25088

CVE-2018-25088: postgraas-server vulnerable to SQL injection

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2018-25088
GHSA ID
GHSA-vghm-8cjp-hjw6
EPSS Score
0.05973%
CWE
CWE-89
Published
7/18/2023
Updated
3/1/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
postgraas-serverpip< 2.0.02.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsafe SQL query construction in create_postgres_db. The commit diff shows the fix transitioned from string interpolation to using psycopg2's SQL composition utilities (SQL() and Identifier()), which properly escape parameters. The vulnerability report specifically identifies this function, and the patch directly addresses SQL injection in database/user creation logic. The high-risk pattern of building SQL with .format() and direct variable interpolation matches classic SQL injection vectors.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility, w*i** w*s *l*ssi*i** *s *riti**l, w*s *oun* in *lu* Yon**r post*r**s_s*rv*r up to *.*.***. *****t** is t** *un*tion `_*r**t*_p*_*onn**tion/*r**t*_post*r*s_**` o* t** *il* `post*r**s_s*rv*r/***k*n*s/post*r*s_*lust*r/post*r*s_*lust*r_*

Reasoning

T** vuln*r**ility st*ms *rom uns*** SQL qu*ry *onstru*tion in *r**t*_post*r*s_**. T** *ommit *i** s*ows t** *ix tr*nsition** *rom strin* int*rpol*tion to usin* psy*op**'s SQL *omposition utiliti*s (SQL() *n* I**nti*i*r()), w*i** prop*rly *s**p* p*r*m